Specify properties of the Secret as part of Database instance - Description, ExcludeCharacters

[rebolyte]

When doing new rds.DatabaseInstance(this, 'AppDb', { ... }), a secret is automatically generated with the database's connection info. This is super useful, but not quite sufficient for my use case. I'd like to be able to specify the secret properties when creating the RDS instance.

Use Case

I need to specify some other characters to exclude from the generated password (specifically ;, since I'll be assembling a semicolon-delimited connection string like Host=abc.com;Port=5432;Username=admin;Password=p@ssw0rd;).

Proposed Solution

Add a secretProperties property to the RDS DatabaseInstanceProps that mixes in any specified options with the defaults when creating the DB secret, e.g.:

const appDbInstance = new DatabaseInstance(this, 'AppDb', {
	databaseName: 'AppDb',
	engine: DatabaseInstanceEngine.POSTGRES,
	engineVersion: '10.9',
	secretProperties: {
		excludeCharacters: '"@/\\;'
	}
});

Other

I would override this manually, but trying this only adds a property to the SecretTargetAttachment not the Secret itself:

const cfnAppSecret = appDbInstance.secret!.node.defaultChild as CfnSecretTargetAttachment;

cfnAppSecret.addOverride('Properties.GenerateSecretString.ExcludeCharacters', '"@/\\;');

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[jogold]

You can do this as a workaround:

const dbSecret = appDbInstance.node.tryFindChild('Secret') as rds.DatabaseSecret;
const cfnSecret = dbSecret.node.defaultChild as secretsmanager.CfnSecret;
cfnSecret.addPropertyOverride('GenerateSecretString.ExcludeCharacters', '"@/\\;');

which will target the AWS::SecretsManager::Secret.

[NGL321]

@rebolyte,

Thanks for submitting this request! It seems like a reasonable feature, however it may take some time to address since it is a fairly specific use-case (if other community members disagree, please leave a comment here!).

If you want to see it implemented faster, the best way may be to submit a PR, and we will make sure it gets reviewed!

[thibaut-pro]

if other community members disagree, please leave a comment here!

We are impacted by this. The backtick ` character in a database password breaks our django configuration.

[nija-at]

Note that you can workaround this limitation by creating your own Secret and using the secretValueFromJson() API to pass in the masterPassword.

[Spacerat]

We also ran into this, since DMS is not compatible with any of ;+%, and arrived at @nija-at 's workaround. I'd volunteer to write a PR for this if someone can confirm an allowable approach. I'd lean towards just allowing users to pass a custom secret via DatabaseInstanceProps.

[ahammond]

I tried the following and am still seeing secrets which break DMS when I rotate:

    const masterSecret = this.cluster.addRotationSingleUser();
    new cdk.CfnOutput(this, 'TheMasterSecret', { value: masterSecret.toString() });

    // Workaround to avoid DMS breaking passwords
    // https://github.com/aws/aws-cdk/issues/4144#issuecomment-533500069
    const dbSecret = this.cluster.node.tryFindChild('Secret') as rds.DatabaseSecret;
    const cfnSecret = dbSecret.node.defaultChild as secretsmanager.CfnSecret;
    cfnSecret.addPropertyOverride('GenerateSecretString.ExcludeCharacters', '"@/\\;+%');

I destroyed and redeployed the entire stack. Then I clicked Rotate secret immediately a few times to check the secrets it was generating. I got a secret with % in it after a couple of tries.

What do I need to do to ensure DMS compatible secrets?

[ahammond]

I see that aws-samples/aws-secrets-manager-rotation-lambdas#32 now supports configurable EXCLUDE_CHARACTERS via an env-var of the same name.

[ahammond]

It looks like while the lambda is updated, the SAM isn't yet: https://console.aws.amazon.com/lambda/home?region=us-east-1#/create/app?applicationId=arn:aws:serverlessrepo:us-east-1:297356227824:applications/SecretsManagerRDSMySQLRotationSingleUser doesn't have excludedCharacters in the Application settings. I guess next step is finding that code and adding a PR.

[playphil]

I noticed excludeCharacters now appears in the AWS console within SecretsManagerRDSMySQLRotationSingleUser — version 1.1.60 for region us-east-1 https://console.aws.amazon.com/lambda/home?region=us-east-1#/create/app?applicationId=arn:aws:serverlessrepo:us-east-1:297356227824:applications/SecretsManagerRDSMySQLRotationSingleUser

[skinny85]

@ahammond now that #10110 has been merged, can we close this issue?

[ahammond]

@skinny85 I think the next and last step involves adding some plumbing to the Aurora module. I'll take a stab at it tomorrow.

[mmeylan]

@skinny85 anything to do to migrate existing DatabaseSecret ? It seems since upgrading to 'aws-cdk@1.65' I can't connect to my DB using the master username & password generated with DatabaseSecret

[skinny85]

@mmeylan is this the same as #10800?